Gabriel Brown
97c3e0a3cd
Rootless podman on cirunner-vps cannot copy cached actions into job containers (symlinks: "path escapes from parent"), so any job that landed there failed. Checkout is now plain git and Bun comes from its install script; both are verified on cirunner-vps.
83 lines
3.7 KiB
YAML
83 lines
3.7 KiB
YAML
name: Build and Push agentchat Image
|
|
|
|
on:
|
|
push:
|
|
branches: [main]
|
|
|
|
jobs:
|
|
quality:
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
- name: Checkout repository
|
|
# Plain git instead of actions/checkout: rootless podman on cirunner-vps
|
|
# rejects symlinks inside cached actions ("path escapes from parent").
|
|
env:
|
|
GITEA_TOKEN: ${{ gitea.token }}
|
|
run: |
|
|
git init -q .
|
|
git remote add origin "${{ gitea.server_url }}/${{ gitea.repository }}.git"
|
|
auth="$(printf 'x-access-token:%s' "$GITEA_TOKEN" | base64 -w0)"
|
|
git -c http.extraHeader="Authorization: basic $auth" \
|
|
fetch -q --depth 1 origin "${{ gitea.sha }}"
|
|
git checkout -q FETCH_HEAD
|
|
- name: Set up Bun
|
|
# Install script instead of oven-sh/setup-bun (same podman symlink issue).
|
|
run: |
|
|
curl -fsSL https://bun.sh/install | bash -s "bun-v1.3.14" >/dev/null
|
|
echo "$HOME/.bun/bin" >> "$GITHUB_PATH"
|
|
- run: bun install --frozen-lockfile
|
|
- name: Typecheck and test
|
|
run: |
|
|
bun run typecheck
|
|
bun test
|
|
|
|
build-image:
|
|
needs: [quality]
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
- name: Checkout repository
|
|
# Plain git instead of actions/checkout: rootless podman on cirunner-vps
|
|
# rejects symlinks inside cached actions ("path escapes from parent").
|
|
env:
|
|
GITEA_TOKEN: ${{ gitea.token }}
|
|
run: |
|
|
git init -q .
|
|
git remote add origin "${{ gitea.server_url }}/${{ gitea.repository }}.git"
|
|
auth="$(printf 'x-access-token:%s' "$GITEA_TOKEN" | base64 -w0)"
|
|
git -c http.extraHeader="Authorization: basic $auth" \
|
|
fetch -q --depth 1 origin "${{ gitea.sha }}"
|
|
git checkout -q FETCH_HEAD
|
|
- name: Log in to container registry
|
|
run: echo "${{ secrets.REGISTRY_PASSWORD }}" | docker login git.gbrown.org -u "${{ secrets.REGISTRY_USER }}" --password-stdin
|
|
# One build-and-push step, fully-qualified tags, --push from the builder.
|
|
# This is the only form that works across all the runners: unqualified
|
|
# names resolve to docker.io/library/* on podman-backed daemons, and
|
|
# buildx docker-container drivers keep plain builds in the build cache
|
|
# where a separate push step can't see them.
|
|
- name: Build and push image
|
|
run: docker build --push -f docker/Dockerfile -t git.gbrown.org/gib/agentchat:${{ gitea.sha }} -t git.gbrown.org/gib/agentchat:latest .
|
|
|
|
# Watchtower was retired 2026-08-17: it recreated containers outside their
|
|
# podman-compose pod, which took gitea down for three days while reporting
|
|
# success. Deploys now SSH to the VPS and restart the systemd UNIT, so
|
|
# podman-compose rebuilds the project properly (pod, networks, ports).
|
|
#
|
|
# The key is pinned to a forced command that accepts only a service name, so
|
|
# it cannot open a shell or reach anything else. 192.168.2.2 is the VPS over
|
|
# WireGuard: reachable from every runner, never the public internet.
|
|
#
|
|
# Non-fatal on purpose: the image is already pushed, and podman-update.timer
|
|
# sweeps at midnight, so a trigger hiccup delays the deploy by hours rather
|
|
# than failing a build that otherwise succeeded.
|
|
- name: Trigger immediate deploy
|
|
run: |
|
|
echo "${{ secrets.DEPLOY_SSH_KEY }}" > "$HOME/.deploy_key"
|
|
chmod 600 "$HOME/.deploy_key"
|
|
ssh -i "$HOME/.deploy_key" \
|
|
-o BatchMode=yes \
|
|
-o StrictHostKeyChecking=accept-new \
|
|
-o ConnectTimeout=15 \
|
|
[email protected] agentchat \
|
|
|| echo "::warning::deploy trigger failed; nightly sweep will deploy instead"
|
|
rm -f "$HOME/.deploy_key"
|